Policing and Shaping

Token Bucket Principles

(C) Herbert Haas 2009/05/02

Policing and Shaping PERIHEL

Policing
 Drops out-of-profile traffic (TCP retransmissions)
 More resource efficient
 Supports incoming and outgoing interfaces
 Supports (re-)marking

Shaping
 Reduces bursts by queuing out-of-profile traffic
• Minimizes TCP retransmits
 Only for outbound interfaces
 Does not support (re-)marking
 "Delay instead drop"

Max rate Max rate

Policing Shaping

(C) Herbert Haas 2009/05/02 www.perihel.at 2

1
Token Buckets PERIHEL

Single Token Bucket

 Token Rate is proportional to Committed
Information Rate (CIR)
 Token Bucket may hold Bc Tokens so all traffic
cannot exceed CIR

Dual Token Bucket (single rate)
 Second bucket keeps extra tokens for bursts
exceeding the CIR
• These tokens are spillovers from the Bc buckets
 Excess rate depends on utilization of
committed rate
• Bursts can only be transmitted if both buckets
contain enough tokens

(C) Herbert Haas 2009/05/02 www.perihel.at 3

Token Buckets (cont.) PERIHEL

Dual-rate Dual Token Bucket

 Allows better bandwidth management
 Supports sustained excess rates
 Excess rate is independent of CIR –
independent rate thresholds!
 Typically applied on network edges
• Allow conform packets
• Remark excess packets (e. g. lower priority)

(C) Herbert Haas 2009/05/02 www.perihel.at 4

2
Dual Token Bucket – Single Rate PERIHEL

CIR = Bc / Tc … Measurement Interval

Overflow:
Overflow Drop Tokens

Committed Burst Size … Bc

Be … Excess Burst Size

Current number of Current number of
tokens in Bc bucket Nc Ne tokens in Be bucket

Size N No No
Packet N < Nc N < (Nc+Ne) Violate

Yes Yes
Nc = Nc – N Nc = Nc – N
Ne = Ne – (N – Nc)

Conform Exceed

(C) Herbert Haas 2009/05/02 www.perihel.at 5

Dual Token Bucket – Dual Rate PERIHEL

Peak Information Rate… PIR CIR

Current number of
Current number of
tokens in PIR bucket Np Nc tokens in CIR bucket

Size N No No
Packet N > Np N > Nc Conform
Nc = Nc – N
Ne = Ne – N
Same amount of tokens
Yes Yes consumed from both buckets
Ne = Ne – N

Violate Exceed
Only the tokens from the PIR bucket
are required to transmit the packet

(C) Herbert Haas 2009/05/02 www.perihel.at 6

3
Practical Comparison PERIHEL

Packet Drop:
No more Tokens in Be and Bc

Violating
PIR PIR
Violating
Exceeding Exceeding
Conforming CIR Conforming CIR

Dual Token – Single Rate Dual Token – Dual Rate

Violation occurs if
Violation occurs only if

 Burst rate exceeds PIR burst rate exceeds PIR
 Or burst duration is too  Ideal for threshold-based
long traffic management

(C) Herbert Haas 2009/05/02 www.perihel.at 7

Other Bucket Principles PERIHEL

Leaky Bucket

Dual Leaky Bucket
 Better performance than Dual Token
Bucket

Hierarchical Token Bucket
 Used by Linux since kernel 2.6.20

Many others…

(C) Herbert Haas 2009/05/02 www.perihel.at 8

4
Configuration PERIHEL

Using Cisco's MQC within policy-

map using the police command

Different implementations depending
on platform and IOS version
 Single/dual Token Bucket with
single/dual rates
 Special Frame-Relay shaping options
(per DLCI or subinterface, using
FECN/BECN)

(C) Herbert Haas 2009/05/02 www.perihel.at 9

Configuration: One Rate DTB PERIHEL

(config-pmap-c)# police <avg-rate>

[<Bc> [<Be>]]
[conform-action <action>]
[exceed-action <action>]
[violate-action <action>]

avg-rate: 8000..200,000,000 bps

Bc: Normal burst size
 Max{ 1500, CIR/32 } bytes (using Tc = 250 ms)

Be: Excess burst size (default: =Bc)

Actions:
 drop | transmit (defaults for exceed/violation | conform)
 set-dscp-transmit value
 set-prec-transmit value
 set-mpls-experimental-topmost-transmit value
 …

Single Token Bucket does not support violate-action

(C) Herbert Haas 2009/05/02 www.perihel.at 10

5
Configuration: Two Rate DTB PERIHEL

(config-pmap-c)# police cir <cir> [bc <bc>]

pir <pir> [be <be>]]
[conform-action <action>]
[exceed-action <action>]
[violate-action <action>]

avg-rate: 8000..200,000,000 bps

Default Bc = Max{ 1500, CIR/32 } bytes (using Tc = 250 ms)

Default Be = Max{ 1500, PIR/32 } bytes (using Tc = 250 ms)

(C) Herbert Haas 2009/05/02 www.perihel.at 11

Configuration: Two Rate DTB with % PERIHEL

(config-pmap-c)# police cir percent <percent> [bc <bc_in_ms>]

pir percent <percent> [be <be_in_ms>]]
[conform-action <action>]
[exceed-action <action>]
[violate-action <action>]

Allows to use the same policy on different

interfaces with different bandwidths

bc and be can be specified in ms
 As equivalent to a percentage

(C) Herbert Haas 2009/05/02 www.perihel.at 12

6
Example & Verification PERIHEL

policy-map MY_TRAFFIC_POLICY
class MY_VOICE
police cir 250000000 conform-action transmit
exceed-action transmit
violate-action drop
class MY_DATA
police cir 250000000 conform-action transmit
exceed-action set-prec-transmit 3
violate-action drop
interface fa0/0
service-policy input MY_TRAFFIC_POLICY

# show policy-map interface fa0/0

(C) Herbert Haas 2009/05/02 www.perihel.at 13

Example: Multi-action PERIHEL

(config)# policy-map police

(config-pmap)# class class-default
(config-pmap-c)# police cir 1000000 pir 2000000
(config-pmap-c-police)# conform-action transmit
(config-pmap-c-police)# exceed-action set-prec-transmit 4
(config-pmap-c-police)# exceed-action set-frde
(config-pmap-c-police)# violate-action set-prec-transmit 2
(config-pmap-c-police)# violate-action set-frde-transmit
(config-pmap-c-police)# end

(C) Herbert Haas 2009/05/02 www.perihel.at 14

7
Shaping PERIHEL

Either shape to
 Average rate (CIR) – but allow up to (Bc+Be)/Tc
 Peak rate – but during congestion drop down to CIR

It is recommended to specify the bit-rate only and
let the IOS calculate Bc and Be
 By default Tc is 4 ms
 If Bc given, then Tc = Bc / CIR

(config-pmap-c)# shape average|peak <bit-rate> [<Bc>] [<Be>]

(config-pmap-c)# shape average|peak percent <%> [<Bc_ms>] [<Be_ms>]

Optionally specify the length of the shaping queue (in packets aka "buffers")

(config-pmap-c)# shape max-buffers 1000

(C) Herbert Haas 2009/05/02 www.perihel.at 15

Shaping Example PERIHEL

shape {average | peak} <cir> [<bc>][<be>]

policy-map MY_FTP_POLICY
class af11-traffic
bandwidth remaining percent 15
random-detect dscp-based
random-detect dscp 10 26 40 10
shape average 16000

(C) Herbert Haas 2009/05/02 www.perihel.at 16